CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the Linux SCTP (lksctp) implementation before version 2.6.17 allows a remote attacker to cause a denial of service (deadlock) by sending a large number of small messages to a receiver application that cannot process them quickly enough. This leads to spillover of the receive buffer and system lockup.
Adobe Dreamweaver 8 before version 8.0.2 and MX 2004 generate code vulnerable to SQL injection attacks in the ColdFusion, PHP mySQL, ASP, ASP.NET, and JSP server models.
A vulnerability in the Linux SCTP (lksctp) implementation before version 2.6.17 allows a remote attacker to cause a kernel panic by sending IP fragmented SCTP control chunks of type COOKIE_ECHO or HEARTBEAT.
A vulnerability in the Linux SCTP implementation (lksctp) before version 2.6.17 allows a remote attacker to cause a kernel panic by sending an unexpected ECNE chunk when the session is in the CLOSED state.
A PHP remote file inclusion vulnerability in includes/config.php of Jetbox CMS 2.1 allows remote attackers to execute arbitrary code by supplying a malicious URL in the relative_script_path parameter.
SQL injection vulnerability in shopcurrency.asp of VP-ASP 6.00 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
SQL injection vulnerability in Chirpy! 0.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
A vulnerability in Cisco PIX/ASA, PIX, and FWSM allows bypassing HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets. An attacker can send a request that is not forwarded to Websense/N2H2 for inspection.
A PHP remote file inclusion vulnerability in visible_count_inc.php in Statit 4 (060207) allows an attacker to execute arbitrary PHP code by supplying a crafted URL in the statitpath parameter.
Multiple SQL injection vulnerabilities exist in Creative Community Portal 1.1 and earlier. Remote attackers can execute arbitrary SQL commands via various HTTP parameters.
SQL injection vulnerability in Logon.asp of MaxxSchedule 1.0 allows remote attackers to execute arbitrary SQL commands via the txtLogon parameter.
A PHP remote file inclusion vulnerability in day.php of ACal 2.2.6 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the path parameter.
SQL injection vulnerability in FlexCustomer 0.0.4 and earlier (also 0.0.6) allows remote attackers to bypass authentication and execute arbitrary SQL commands via the checkuser, checkpass, username, and password parameters in the admin and ordinary user interface.
SQL injection vulnerability in readarticle.php of Newsadmin 1.1 allows remote attackers to execute arbitrary SQL commands via the nid parameter.
A buffer overflow vulnerability exists in the Quake 3 Engine, used by ET 2.60, Return to Castle Wolfenstein 1.41, and Quake III Arena 1.32b, in the remapShader command. A remote attacker can send a long string, leading to arbitrary code execution.
A buffer overflow vulnerability in BankTown Client Control (BtCxCtl20Com) version 1.4.2.51817 and possibly 1.5.2.50209. A remote attacker can execute arbitrary code by sending a long string as the first argument to the SetBannerUrl function.
A vulnerability in Simple Poll 1.0 by CodeMunkyX (free-php.net) allows remote attackers to gain administrative privileges by appending /admin/ to the top-level URI when authentication is not required for the admin directory.
A buffer overflow vulnerability in XM Easy Personal FTP Server 4.3 and earlier, triggered by a long username in the USER command, allows remote attackers to execute arbitrary code.
Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid parameter in top.php and member.php.
An unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via exceptional conditions that trigger memory corruption. The attack uses an exception handler and nested object tags, being a variant of CVE-2006-1992.